Overview

overview

10

Static

static

3

RakBot.exe

windows7-x64

10

RakBot.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RakBot.exe_infected

  • Size

    1.1MB

  • Sample

    241029-2w3x9s1hkq

  • MD5

    0a4bcbacfca9876e5914933a8481391e

  • SHA1

    91876f816adca7cd5eace2b23134eac094ea78ae

  • SHA256

    708f1bcec066db275b751c43a2b92fe54ea5f82e33c61b0114a249476a9ad8d6

  • SHA512

    7b089c7c6c6f22015cda9d74b8fbfcd7c29fad97c1eb62b3af6c3ab4b0b6994a07e258795ede117b7fab6057fca3c34de1afde010b830a5cbffdc78d42a598f7

  • SSDEEP

    24576:l9h9ghwRVQAOBdlSER9MysrYx4ltFbc+Dyd8oC:lr9k3lPLMJYxEv0C

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      RakBot.exe_infected

    • Size

      1.1MB

    • MD5

      0a4bcbacfca9876e5914933a8481391e

    • SHA1

      91876f816adca7cd5eace2b23134eac094ea78ae

    • SHA256

      708f1bcec066db275b751c43a2b92fe54ea5f82e33c61b0114a249476a9ad8d6

    • SHA512

      7b089c7c6c6f22015cda9d74b8fbfcd7c29fad97c1eb62b3af6c3ab4b0b6994a07e258795ede117b7fab6057fca3c34de1afde010b830a5cbffdc78d42a598f7

    • SSDEEP

      24576:l9h9ghwRVQAOBdlSER9MysrYx4ltFbc+Dyd8oC:lr9k3lPLMJYxEv0C

    Score
    10/10
    dcratdiscoveryinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks